A Modern European Data
Protection Framework

Bruno Gencarelli
DG JUSTICE and CONSUMERS

Outline• I.

The EU Data Protection
elements, implementation

Reform:objectives,main• a harmonised and simplified framework• an updated set of rights and obligations• a modern governance system• II.

International transfers of personal data: from theEU Data Protection Reform to the 10 Jan. 2017
Commission’sCommunication
onExchanging
andProtecting Personal Data in a Globalised World• facilitating trade by protecting privacy, including throughpossible adequacy decisions with key trading partners"starting with Japan and Korea" (see Communication, p. 8and Abe-Juncker statement of 6 July 2017)• more effective law enforcement cooperation with robust dataprotection safeguards• promoting convergence and international cooperation, inparticular in the framework of Convention 108 of theCouncil of Europe

The EU Data Protection Reform
Package: timeline
 General Data Protection Regulation (GDPR) Directive in the field of police and criminal justicecooperation (Police Directive)

2012:
Proposals

2016:
Adoption

25 May2018:
Application

Why a new European framework for
Data Protection?
• Technology developments and globalisation:
addressing the challenges and seizing the opportunitiesof the digital economy• Constitutionalisation of the fundamental right todata protection (Lisbon Treaty)• Fragmentation of legislative framework (differenttransposition of Directive 95/46/EC into national laws)

Main objectives and major changes
RULES FIT FOR THE DIGITAL SINGLE MARKET (aharmonised and simplified framework)
One single set of rules, "one-stop-shop" mechanism,
cutting red tape …
PUTTING INDIVIDUALS IN CONTROL OF THEIR DATA(an updated set of rights and obligations)
Enhancing transparency, clarifying the conditions forconsent, notification of data breaches, right to data
portability, right to be forgotten, risk-based approach…
A MODERN DATA PROTECTION GOVERNANCE
Stronger national DPAs, consistency mechanism for crossborder cases, establishment of a European Data Protection
Board to ensure consistent application of the Regulation,
credible sanctions…

A harmonised and simplified framework• One single set of data protection rules for the EU(Regulation)• One interlocutor and one interpretation (one-stopshop and consistency mechanism)• Creating a level playing field (territorial scope)• Cutting red tape (abolishment of most priornotification and authorisation requirements), including
as regards international transfers
6

An updated set of rights and obligations• Evolution rather than revolution: basic architecture
and core principles are maintained (key principles, legal
bases for processing, individual rights, notion of personaldata)• Putting individuals in better control of their data
(e.g. consent to be given by clear affirmative action,better information about data processing)….
• …including through the introduction of new rights(e.g. right to portability) and obligations (e.g. databreach notification)• Obligations graduated in function of the nature andpotential risks of processing operations (risk-basedapproach: DPO, DPIA, data breach notification)

7• Stronger rights, clearer obligations, more trust

A modern governance system• Better equipped DPAs and better cooperation
amongst them (e.g. joint investigations)• A new decision-making process for cross-bordercases (the consistency mechanism)• The creation of the European Data Protection Board(guidance and dispute settlement)• Credible and proportionate sanctions (2/4% of global
turnover in light of nature, duration, gravity etc. of theviolation)

8The transition period and beyond• GDPR will apply from 25 May 2018
• Preparing a compliance-ready/friendly environment:”We need to use this time well to get everybody, i.e.
Member States, DPAs, citizens and companies to prepare
for the new rules. The Commission will work closely with
the Member States, data protection authorities and otherstakeholders to ensure a uniform application of therules. We will also” run awareness-raising campaigns
so that citizens know their new rights (Commissioner V.
Jourová)The transition period and beyond• Aligning other legislative instruments (e.g. 10 Jan. 2017
proposal for an ePrivacy Regulation)• Central role of DPAs (Art. 29 WP/EDPB) – guidelines issued so
far concern data portability, DPOs, ‘Lead Authority’, DPIAs
and administrative fines.
• Final adoption of guidelines after consultation of stakeholders.
Consultation just concluded on draft guidelines on data breach
notifications and profiling. Ongoing consultation until 23rd Jan.
2018 on consent and transparency.
• Close dialogue with Member States on national implementation• Commission’s implementing andrequirements for certification schemes)delegated• Market-driven instruments (e.g. codes of conduct)• Setting up of a multistakeholder expert groupacts(e.g.

International personal data transfers
1. ADRESSING THE CHALLENGES OF GLOBALISATION• In today’s globalised world, personal data is beingtransferred across an increasing number of borders andstored on servers in multiple countries• Trade relies more and more on personal data flows• These transfers have to be facilitated• At the same time continuity of protection of individuals’rights must be ensured: the protection should travel withthe data!
• Privacy and security of data have become a central factorof consumer trust• Promoting high standards of data protection contributes tofree, stable and competitive commercial flows
111. HOW IS THIS ADDRESSED IN THE REFORM AND THE 10
JAN. 2017 COMMUNICATION?

1. Clear rules defining when EU law is applicable (including tooperators established abroad if offering goods or services in the EU)
2. A renewed and diversified toolkit for international transfers• Precise criteria for adequacy decisions, possibility of partial or sectorspecific adequacy, new possibility to adopt adequacy decisions in thelaw enforcement sector. Adequacy is the most advantageous transfer
mechanism: transfers to the third country are assimilated to intra-EUtransmissions of data.
• Simplification (abolishment of prior notification/authorisation) andexpanded possibilities of use of other tools for transfers (standard
contractual clauses, BCRs)• Introduction of new tools (e.g. certification mechanisms, approved
codes of conduct)
3. International cooperation in the field of data protectionenforcement (Art. 50 of GDPR)
4. A strategic action plan for international transfers (Communicationof 10 Jan. 2017): at bilateral level renewed focus on adequacy(starting with Japan and Korea), at multilateral level promotion ofconvergence (in particular in the framework of Convention 108 of theCouncil of Europe)Thank you very much for your attention!